security enabled verified low v1.0.0

theHarvester

OSINT tool for gathering emails, subdomains, IP addresses, and URLs from public data sources for a target domain.

📋 Live Preview

theHarvester -d {domain} -b {source} -l {limit}

🌍 domain → example.com 🌍 source → all 🌍 limit → 500

theHarvester -d {domain} -b {source} -l {limit}

Sandbox: execFile · Timeout: 300s

Capabilities

security.intel.email

network.discovery.subdomain

security.recon.passive

security.intel.osint

security.intel.host

Parameters

Name	Type	Required	Default	Description	Aliases
`flag-d`	string	Yes	-	Company name or domain to search	`-d`, `--domain`
`flag-b`	string	Yes	-	Data source (baidu, brave, crtsh, dnsdumpster, google, shodan, etc.)	`-b`, `--source`
`flag-l`	integer	No	500	Limit the number of search results	`-l`, `--limit`
`flag-S`	integer	No	0	Start with result number X	`-S`, `--start`
`flag-p`	boolean	No	-	Use proxies for requests	`-p`, `--proxies`
`flag-s`	boolean	No	-	Use Shodan to query discovered hosts	`-s`, `--shodan`
`flag-e`	string	No	-	DNS server to use for lookup	`-e`, `--dns-server`
`flag-t`	boolean	No	-	Check for subdomain takeovers	`-t`, `--take-over`
`flag-r`	string	No	-	Perform DNS resolution on subdomains	`-r`, `--dns-resolve`
`flag-n`	boolean	No	-	Enable DNS server lookup	`-n`, `--dns-lookup`
`flag-c`	boolean	No	-	Perform DNS brute force on the domain	`-c`, `--dns-brute`
`flag-f`	string	No	-	Save results to XML and JSON file	`-f`, `--filename`
`flag-w`	string	No	-	Wordlist for API endpoint scanning	`-w`, `--wordlist`
`flag-q`	boolean	No	-	Suppress missing API key warnings	`-q`, `--quiet`
`api_scan`	boolean	No	-	Scan for API endpoints.	`--api-scan`
`e`	boolean	No	-	DNS_SERVER DNS server to use for lookup.	`-e`, `--dns-server`
`h`	boolean	No	-	show this help message and exit	`-h`, `--help`
`n`	boolean	No	-	Enable DNS server lookup, default False.	`-n`, `--dns-lookup`
`p`	boolean	No	-	Use proxies for requests, enter proxies in proxies.yaml.	`-p`, `--proxies`
`r`	boolean	No	-	Perform DNS resolution on subdomains	`-r`, `--dns-resolve`
`screenshot`	boolean	No	-	SCREENSHOT Take screenshots of resolved domains specify output dir	`--screenshot`
`w`	boolean	No	-	WORDLIST Specify a wordlist for API endpoint scanning.	`-w`, `--wordlist`

Artifacts

Type	Description	MIME	Schema	Trust
`security.intel.email.list`	Discovered email addresses	text/plain	-	community
`security.recon.subdomain.list`	Discovered subdomains	text/plain	-	verified
`security.intel.host.list`	Discovered hosts and IP addresses	text/plain	-	verified

Contract

Inputs

network.target.domain

Company name or domain to search

Outputs

security.intel.email.list

Found email addresses

security.recon.subdomain.list

Found subdomains

Side effects: network_trafficnetwork_traffic

Workflow Edges

Produces

security.intel.email.listsecurity.recon.subdomain.list

Consumes

network.target.domain

Resource Profile

Resource	Value
CPU	low
Memory	64 MB
Network	medium
Disk I/O	low

Examples

Gather emails and subdomains from all sources

theHarvester -d example.com -b all

Search Google for email addresses

theHarvester -d example.com -b google -l 200

Query certificate transparency logs for subdomains

theHarvester -d example.com -b crtsh

Use Shodan to find host information

theHarvester -d example.com -b shodan -s

DNS brute force with custom wordlist

theHarvester -d example.com -c -w /usr/share/wordlists/subdomains.txt

Check for subdomain takeover vulnerabilities

theHarvester -d example.com -b crtsh -t

Save results to file

theHarvester -d example.com -b all -f results

Use proxies to avoid rate limiting

theHarvester -d example.com -b google -p

Documentation

theHarvester — OSINT Intelligence Gathering

theHarvester is a comprehensive OSINT tool designed for gathering emails, subdomains, IP addresses, and URLs from over 50 public data sources. It is widely used in the reconnaissance phase of penetration testing and red team engagements.

Data Sources

theHarvester supports 50+ data sources including:

Search engines: Google, Bing, Yahoo, DuckDuckGo, Baidu
Certificate transparency: crt.sh, CertSpotter
Threat intelligence: VirusTotal, AlienVault, Shodan
DNS: DNSDumpster, SecurityTrails
Code repos: GitHub, GitLab

Output

# Save results to XML and JSON
theHarvester -d example.com -b all -f output

# DNS resolution and brute forcing
theHarvester -d example.com -c -n

Dependencies

python3

Related Tools

recon-ngspiderfootamasssubfinder

References

theHarvester GitHub